# Changing notice log entry actions from Action::Log to Action::Email
**URL:** https://community.zeek.org/t/changing-notice-log-entry-actions-from-action-log-to-action-email/4804
**Category:** Zeek
**Created:** [April 25, 2017, 8:45pm UTC](https://community.zeek.org/t/changing-notice-log-entry-actions-from-action-log-to-action-email/4804 "2017-04-25T20:45:33Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@espressobeanies](https://community.zeek.org/u/espressobeanies)
#### Post date: [April 25, 2017, 8:45pm UTC](https://community.zeek.org/t/changing-notice-log-entry-actions-from-action-log-to-action-email/4804/1 "2017-04-25T20:45:33Z")
Hi,
In searching previous Bro posts, I’m still not able to understand how to get Bro to email certain notice types as opposed to just creating log entries.
My local.bro file contains the following:
> redef Notice::emailed\_types += {
> TeamCymruMalwareHashRegistry::Match,
> Intel::Notice,
> Intel::DOMAIN,
> Intel::CERT\_HASH,
> Intel::FILE\_HASH,
> };
> redef Notice::type\_suppression\_intervals += {
> [TeamCymruMalwareHashRegistry::Match] = 1hr,
> [Intel::Notice] = 1hr,
> [Intel::DOMAIN] = 1hr,
> [Intel::CERT\_HASH] = 1hr,
> [Intel::FILE\_HASH] = 1hr,
> };
Based on this, I’m assuming I would be receiving a summary of all the defined Notice::emailed\_types every hour by email. Instead, I’m only receiving Connection Summaries, [Bro] Crash reports, and PacketFilter::Dropped\_Packets.
If I open my notice.log I see the following:
#separator \x09
#set\_separator ,
#empty\_field (empty)
#unset\_field -
#path notice
#open 2017-04-25-16-00-22
#fields ts uid id.orig\_h id.orig\_p id.resp\_h id.resp\_p fuid file\_mime\_type file\_desc proto note msg sub src
dst p n peer\_descr actions suppress\_for dropped remote\_location.country\_code remote\_location.region remote\_location.city remote\_locat
ion.latitude remote\_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum]
interval bool string string string double double
1493150418.640398 - - - - - - - - - SSH::Password\_Guessing XXX.XXX.XXX.XXX appears to be guessing SSH pass
words (seen in 41 connections). Sampled servers: XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX - -
- worker-2-9 Notice::ACTION\_LOG 3600.000000 F - - - - -
1493150706.509497 - - - - - - - - - SSH::Password\_Guessing XXX.XXX.XXX.XXX appears to be guessing SSH passw
ords (seen in 34 connections). Sampled servers: XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX, XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX - -
- worker-2-3 Notice::ACTION\_LOG 3600.000000 F - - - - -
1493150707.543255 - - - - - - - - - HTTP::SQL\_Injection\_Attacker An SQL injection attacker was discover
ed! - XXX.XXX.XXX.XXX - - - worker-1-11 Notice::ACTION\_LOG 3600.000000 F - - - - -
1493151025.415982 - - - - - - - - - CaptureLoss::Too\_Much\_Loss The capture loss script detected an es
timated loss rate above 24.664% - - - - - worker-2-6 Notice::ACTION\_LOG 3600.000000 F - - - -
---
### Author:  [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)
#### Post date: [April 25, 2017, 9:16pm UTC](https://community.zeek.org/t/changing-notice-log-entry-actions-from-action-log-to-action-email/4804/2 "2017-04-25T21:16:12Z")
> Hi,
>
> In searching previous Bro posts, I'm still not able to understand how to get Bro to email certain notice types as opposed to just creating log entries.
>
> My local.bro file contains the following:
>
> redef Notice::emailed\_types += {
> TeamCymruMalwareHashRegistry::Match,
> Intel::Notice,
> Intel::DOMAIN,
> Intel::CERT\_HASH,
> Intel::FILE\_HASH,
> };
...
> For these entries, where or what file do I change specific Notice::Types from Notice::ACTION\_LOG to Notice::ACTION\_EMAIL?
The Notice::emailed\_types that is in your local.bro that you included in your email.
If you want to get emailed about SSH::Password\_Guessing then it should be in the emailed\_types set.
[https://www.bro.org/sphinx/frameworks/notice.html#notice-policy-shortcuts](https://www.bro.org/sphinx/frameworks/notice.html#notice-policy-shortcuts)
---
### Author:  [@espressobeanies](https://community.zeek.org/u/espressobeanies)
#### Post date: [April 26, 2017, 3:36pm UTC](https://community.zeek.org/t/changing-notice-log-entry-actions-from-action-log-to-action-email/4804/3 "2017-04-26T15:36:56Z")
Ah, got it. Thanks Justin.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/changing-notice-log-entry-actions-from-action-log-to-action-email/4804/4 "2022-05-06T15:44:52Z")